Notes from a BFSI Hybrid Migration: An Audit Diary

These notes are reconstructed, with permission, from the engagement diary I kept during a Tier-1 commercial bank’s eighteen-month hybrid migration. Names are removed; sequence is preserved. Where I quote myself or a colleague, the quote is from the original notebook. The bank had a twelve-year-old private cloud built on vSphere, a passably modern security posture under Bangladesh Bank’s ICT Security Guideline, and the usual accumulated decisions that nobody remembers making. The brief was simple: move to hybrid without disturbing the audit story. The work was not.

The diary

Where each phase landed

The conversations the diary did not capture

The diary captures decisions, but the conversations between decisions are where the programme actually lived. The most consequential of these were not technical. They were the moments — usually at month four, eight, and twelve — when the platform team’s credibility was on the line with a sceptical BU head who needed to ship something the regulator would tolerate and finance would pay for. We learned, slowly, that those conversations went better when the platform team showed up with the data flow map, the chargeback table, and the FIDO2 PAM logs already printed; the BU head typically arrived assuming the platform team had not done the work, and the evidence was its own argument.

What the BB visit actually asked for

The visit at month eleven was the most consequential single event of the programme. Not because the auditor found anything — they did not — but because the questions they asked told us, definitively, where the next nine months of investment should go. The first hour was about the data flow map: where personal data of customers entered the system, where it was processed, where it sat at rest, where it left, and what controls applied at each boundary. The second hour was about privileged access: who had it, how it was bounded in time, how the records survived the session. The third hour was the asset inventory. The order was not accidental.

What the diary says in retrospect

Three things stand out reading it back. First, the inventory shock at month one was the most consequential single event of the programme — it forced the platform team and the audit function into the same room, and they have not left since. Second, Phase 1 felt slow at the time and bought us twelve months on every subsequent phase. Third, the BB visit at month eleven was decisive: a programme that cannot show its data-flow map at month eleven is a programme that will be writing one in panic at month twenty-four.

What I would do differently

Two things. I would budget twice as long for identity federation in Phase 3, because every BFSI programme I have seen over-runs that step. And I would invest earlier in operational runbooks — by Phase 3, the platform team was running production for systems they had not designed, and the absence of crisp runbooks was felt every time an incident escalated past the on-call rotation.